> ## Documentation Index
> Fetch the complete documentation index at: https://help.afflo.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Password, two-factor authentication, and active sessions.

The **Security** tab protects your own account. Teammates manage their own security settings.

## Change your password

1. Open **Settings → Security**.
2. Enter your current password.
3. Enter a new password and confirm it.
4. Click **Update password**. You'll stay signed in on this device.

<Tip>
  Use a password manager and a unique password for Afflo. Avoid words tied to your company or date of birth.
</Tip>

## Two-factor authentication (2FA)

Turn on 2FA to require a second code every time you sign in.

1. Click **Enable 2FA**.
2. Scan the QR code with an authenticator app (Google Authenticator, 1Password, Authy, etc.).
3. Enter the six-digit code from your app to confirm.
4. Save the recovery codes Afflo shows you somewhere safe — you'll need them if you lose your device.

## Active sessions

This section lists every browser or device currently signed in to your account. If you see something unfamiliar:

1. Click **Sign out** next to the session.
2. Change your password right after.
3. Contact support if you want a full audit of recent activity.

You can also click **Sign out of all other sessions** to force every device except the current one to sign out.

## API keys (for advanced teams)

If your plan includes programmatic access, you can generate and revoke API keys here. Treat keys like passwords: store them in a secrets manager, never share in chat or email, and rotate them when a teammate leaves.

## Tips

* Turn on 2FA. A stolen password alone won't get anyone in.
* Review active sessions every few months, especially if you've used shared or public computers.
* When a teammate leaves, remove them from **Settings → Team** immediately — they lose access to the whole workspace.

## Related

<CardGroup cols={2}>
  <Card title="Your account" icon="user" href="/account/your-account">
    Profile and email settings.
  </Card>

  <Card title="Team" icon="users" href="/settings/team">
    Remove teammates who have left.
  </Card>
</CardGroup>